Security Overview

Effective date: October 16, 2026

1. About This Overview

DealerPointe, LLC (“DealerPointe”) provides four service offerings: Censa™ Technology Expense Optimization (“Censa”); Process Design & Customer Retention; Fractional GTM & Revenue Leadership; and Specialized Advisory & Transactions. Our clients are dealerships and dealer groups, and automotive technology and service companies. Many of our customers are “financial institutions” under the FTC Safeguards Rule (16 CFR Part 314) and must oversee their service providers. This overview summarizes how we protect your information. It is provided for information only. Our binding commitments are in your customer agreement and Data Processing Addendum (“DPA”).

DealerPointe maintains a Written Information Security Program overseen by DealerPointe’s owner, Charles Daniel, our Qualified Individual. A summary of the program is available to customers on request, under a confidentiality agreement.

2. What Censa Collects — and What It Does Not

Censa reviews your software and technology expense lines to find duplicate tools, unused seats, overlapping contracts and forgotten subscriptions. It is built to take in as little data as possible.

Six columns only. Your controller exports a CSV of software and technology expense lines (not the full general ledger). Censa accepts only six columns: store, vendor, department, amount, date, seats (optional). A file with any other column is rejected before its contents are processed.
Headcount as numbers. You also enter rough headcount by department — numbers only.
No consumer data. Censa does not collect your customers’ (consumers’) personal or financial information. It is not a system for storing consumer nonpublic personal information.
User data. For people you invite, Censa holds names, work email addresses, sign-in records and audit logs of actions.

3. Masking

Long digit strings in the text (such as account or check numbers) are replaced with “•” before anything is saved. The records Censa keeps after that 7-day deletion do not contain account numbers.

4. Encryption

Data is sent over encrypted connections (TLS).
Data is stored encrypted.
In addition, the original vendor description from each expense line, exactly as uploaded, is encrypted with a separate key for each dealer, and those keys are encrypted with a master key kept outside the database. The other details used for the review (amounts, dates, store and department names, and a standardized copy of each vendor name used for matching) are protected by the storage encryption and by database-level separation between dealers.

5. Tenant Isolation

Each dealer’s data is isolated at the database level using row-level security, so one dealer cannot see another dealer’s data.

6. Access Control

Only people your dealership invites get access. The Censa sign-in page offers two ways to sign in, and your dealership chooses which one each user uses. We recommend the authenticator app. Your dealership is responsible for its choice and for protecting its users’ work email accounts and phones. We keep a record of which method each user chose.
Email me a code: you enter your work email and we email you a 6-digit sign-in code. The code works once and expires after 15 minutes, and requesting a new code replaces the earlier one. There is nothing to download.
Use my authenticator app: two-step sign-in. The first time, an emailed code confirms it is you; you then add Censa to an authenticator app and receive 10 single-use recovery codes, which work if your phone is lost. Once you set up the app, your account always requires it, and emailed codes no longer open it.
DealerPointe staff sign in to Censa with a password plus an authenticator code.
After 5 wrong attempts, with either method, an account is locked for 15 minutes. Sessions end after 30 minutes without activity and after 12 hours in any case.
Dealer sign-ins can only add information: upload the expense file, enter headcount and answer your advisor’s questions. Findings and reports cannot be viewed in Censa; your report is sent by email.
Please keep sign-in codes and recovery codes private, protect access to your work email accounts and phones, and tell us right away at info@dealerpointe.com if a work email account or phone may have been compromised.
DealerPointe staff access is limited to people who need it to deliver the service.
Two-step verification (multi-factor authentication) is required for all DealerPointe staff accounts.
The Censa app itself is private and not indexed by search engines.

7. People Make the Decisions

Censa uses automated matching and analysis, with AI assistance reviewed by a person, to compare your expense lines to a catalog of known vendors and flag possible waste. A DealerPointe advisor then reviews the findings with you on a Microsoft Teams video call. You make every keep/cut/right-size decision. We find it. You decide. Censa does not cancel anything or contact vendors unless you ask.

AI assistance. Censa uses Anthropic’s Claude models to help DealerPointe’s advisor prepare each review: researching vendors’ public product information for the vendor catalog, suggesting matches for vendor names Censa does not recognize, spotting tools that may do the same job, checking what a dealer’s main systems already include, looking up public renewal and manufacturer program terms, and drafting questions, letters and report summaries for the advisor to edit. DealerPointe’s server sends the AI provider: only vendor names and expense-line descriptions, with long numbers already masked; each tool’s category, capabilities, monthly cost, seat count and number of stores; the franchise brands sold, for manufacturer program checks; and job titles Censa could not place in a department, without names or headcounts. Some research reads vendors’ and manufacturers’ public websites through the provider’s web search. We never send the dealer group’s name, store names, people’s names, email addresses, account numbers or any consumer information. The AI runs only on DealerPointe’s server. Its output is a suggestion, and a DealerPointe advisor reviews every suggestion before it affects a catalog entry, a finding, a question sent to the dealer or the report.

DealerPointe does not use Customer Data to train artificial-intelligence models. Anthropic does not train its models on data sent through its commercial service and keeps that data only for a limited time.

8. Audit Logging

Censa keeps audit logs of user actions, including every sign-in, failed sign-in attempt and emailed sign-in code. An audit-log entry also records each automatic deletion of your uploaded data.

9. Automatic Deletion

At the end of your review call, an executive report (PDF) is generated and emailed to your CFO or designated recipient. Report snapshots are frozen once delivered.
Your uploaded expense lines, headcount figures and everything built from them are permanently deleted 7 days after the report is delivered. For Censa Plus customers, each later upload is likewise permanently deleted 7 days after its report is delivered.
If a correction is needed, DealerPointe staff can place a hold. Releasing the hold restarts a fresh 7-day period. A hold lasts at most 30 days; after that, the data is deleted even if the hold is still on.
An upload that never leads to a delivered report is permanently deleted 60 days after it was uploaded.
Backups taken before deletion expire on our hosting provider’s schedule (about 7 days). Until those backups expire, any copies of deleted lines in them remain encrypted and are used only to recover from a system failure.
What we keep after deletion: only the final report (with your decisions), its follow-up savings record (savings outcomes and check-ins) and the activity (audit) log. None contain account numbers.
Twelve months after the report: these are permanently deleted 12 months after the report is delivered, or sooner if you ask, and your Censa sign-in accounts are closed then, unless a newer review is still within its own 12 months. For Censa Plus clients, reports are kept while the plan is active and for 12 months after it ends.
DealerPointe’s contracts and invoices are its own business records and are kept as the law requires.

10. Sub-processors

We use a small number of service providers to run Censa and our business:

Provider	Purpose
Supabase (database), Render (application server) and Vercel (app delivery)	Censa hosting and database
Resend	Email delivery (sign-in codes and reports)
Microsoft 365 (Outlook, Teams and Bookings)	Email, video calls and scheduling
Anthropic, PBC	AI model provider for the research assistant (vendor research, match suggestions, overlap and coverage checks, and drafts for the advisor)

We will notify customers by email at least 30 days before adding a provider that handles customer data.

11. Incident Notification

DealerPointe maintains a written Incident Response Plan. If we confirm a security incident affecting your data, we will notify your designated contact without undue delay and no later than 72 hours, consistent with the DPA. We will share what we know, keep you updated, and cooperate with your investigation.

If you are a financial institution under the Safeguards Rule, you may need to notify the FTC within 30 days of discovering a notification event involving the information of 500 or more consumers. That notice is your responsibility. DealerPointe will support you by promptly providing the facts we have, to help you meet that deadline.

12. Our Other Services Are Advice Only

Process Design & Customer Retention (including on-site coaching and technology enablement), Fractional GTM & Revenue Leadership, and Specialized Advisory & Transactions (including M&A due diligence and post-acquisition integration) are advice and coaching only. We do not install, configure, maintain, update, fix, monitor or support technology for you, we do not audit your CRM or DMS, and we never access or log into your computer systems. In post-acquisition integration, we advise on the process and technology switch and work with your staff and vendors, who operate your systems and handle any customer data. We do not need, and will not ask for, credentials to your systems or your consumer customer information.

If we are ever incidentally exposed to consumer customer information (for example, on a screen during on-site coaching), we will not record, copy or retain it, and we will tell you.

13. Our Team and Program

DealerPointe reviews its security risks in writing at least once a year.
Censa was reviewed internally before launch (October 2026). An independent security test is planned once client volume supports it.
DealerPointe does not currently claim any third-party security certification.

14. Contact

Security questions, questionnaires or requests for more information: info@dealerpointe.com

DealerPointe, LLC, 12400 Wake Union Church Rd #3-202, Wake Forest, NC 27587 — www.dealerpointe.com